2

I have a dedicated browser (Firefox) profile that I use for accessing online banking systems (and only for that). The current setup is (summarising) as follows:

  1. I have it set to clear all history and cookies when closing the browser.
  2. I have a master password set up to protect saved passwords (in addition to all my browser profiles being separately encrypted).
  3. I have bookmarked all the banking sites that I want to use (so I never have to google them or anything of the sort).
  4. I have the cookie whitelist extension, so that I don't get any cookies I don't explicitly allow.
  5. I have NoScript, so that only the sites I allow can run any scripts.
  6. I have Self-Destructing Cookies, so that the cookies erase themselves after I close their tabs.
  7. I have RememberPass, so that I can save passwords even in those sites that won't let me.
  8. I don't keep the passwords online, I only copy them between computers offline via an encrypted file on a USB stick/via local network/manually.

One thing I have an obvious problem with are those silly sites that have me input only select characters from the password. The only way I see to type those in with extreme hassle is to have an encrypted file with numbered characters in each password, but that is still a bit of a hassle and doesn't feel as secure as I'd like it to be (in particular, I have the text file open on my screen and I have to painstakingly input every character, which might leave me open to shoulder surfing if I'm less careful).

So the question is: are there any obvious ways in which I can improve the setup (without crippling usability, I'm not that rich or paranoid)? Perhaps there is another browser better suited for the job, or some extensions that might help with security or usability (see esp. the previous paragraph)?

I use similar profiles in both Linux and Windows.

  • 1
    any obvious ways in which I can improve the setup how do you feel about VMs? – Thebluefish Aug 1 '16 at 14:38
  • @Thebluefish: I don't have much experience with them. I can see how they could be used to improve security (and portability, I guess), but I'm not quite sure about the "not crippling usability" part. If it can be done without making usage a chore, then it would be interesting to hear, at least. – tomasz Aug 1 '16 at 14:53
  • It depends on what you mean by crippling usability. In my experience, given enough RAM, virtual machines are not much slower than your regular OS. As far as experience is concerned, if you've ever installed an OS from an ISO, you're completely fine. Even if you're not, there are a lot of tutorials about how to install and use virtual machines on both Virtualbox and VMWare. – A. Darwin Aug 1 '16 at 15:17
  • one step above a VM: a bootable thumb drive that has firefox on it. – dandavis Aug 1 '16 at 20:17
1

Your setup seems to take precautions against the banking site itself (NoScript, no cookies, etc), the issue is that site would be relatively safe (and if not, it's the bank's problem, not yours).

On the other hand, malware caught by browsing in your other, non-banking browser would still be free to spy on you and observe anything you do in the banking browser once it owns your entire user account.

If you do want to protect your online banking I suggest you do so on an isolated computer where you do nothing but banking (no way to catch malware through other sites, etc). If you do not have a second computer you can do all your non-sensitive activities in a VM, which if compromised should provide good enough isolation to prevent compromise of the host where you do sensitive activities. Note that doing the opposite (non-sensitive stuff on the host, sensitive stuff in a VM) will do nothing because the host has full access to the VMs by design, so once the host is owned, so are the VMs.

1

Dedicating a whole computer to Internet banking is a bit too much, therefore I would advise you to download another browser, Opera for example, to secure it and to use it only for banking. Malware infecting Firefox won't be active in the other browser.

Tor browser is also a good alternative.

If you want to keep Firefox, I would suggest a USB key with Firefox portable edition, installed and secured and used only for I Banking. It is a good solution as your data will be available on your computer only when the USB key is in.

If you are afraid of keyloggers you can use a key scrambler.

  • Why is Tor a good alternative here? – Jedi Jul 5 '17 at 17:48
  • If the guy wants to keep Firefox, Tor is in fact a special Firefox which can be run concurrently with Firefox. This not the case of Firefox portable which cannot be executed at the same time as Firefox standard. – Olivier Jul 5 '17 at 18:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.